gnablib/dist/crypto/mac/Poly1305.js

A lean, zero dependency library to provide a useful base for your project.

/*! Copyright 2023-2024 the gnablib contributors MPL-1.1 */
var t,s,i,h,e,r=this&&this.__classPrivateFieldGet||function(t,s,i,h){if("a"===i&&!h)throw new TypeError("Private accessor was defined without a getter");if("function"==typeof s?t!==s||!h:!s.has(t))throw new TypeError("Cannot read private member from an object whose class did not declare it");return"m"===i?h:"a"===i?h.call(t):h?h.value:s.get(t)},f=this&&this.__classPrivateFieldSet||function(t,s,i,h,e){if("m"===h)throw new TypeError("Private method is not writable");if("a"===h&&!e)throw new TypeError("Private accessor was defined without a setter");if("function"==typeof s?t!==s||!e:!s.has(t))throw new TypeError("Cannot write private member to an object whose class did not declare it");return"a"===h?e.call(t,i):e?e.value=i:s.set(t,i),i};import{asLE as n}from"../../endian/platform.js";import{U64 as o,U64Mut as a}from"../../primitive/number/U64.js";import{ChaCha20 as c,XChaCha20 as l}from"../sym/ChaCha.js";import{Salsa20 as w,XSalsa20 as _}from"../sym/Salsa.js";import{LengthError as y}from"../../error/LengthError.js";import{sLen as p}from"../../safe/safe.js";const u=16;export class Poly1305{constructor(o){this.blockSize=u,this.size=u,t.set(this,new Uint16Array(10)),s.set(this,void 0),i.set(this,new Uint16Array(10)),h.set(this,new Uint8Array(u)),e.set(this,new Uint16Array(r(this,h,"f").buffer)),this._bPos=0,p("key",o).exactly(32).throwNot();const a=new Uint16Array(o.slice(0,16).buffer),c=new Uint8Array(a.buffer);n.i16(c,0,8),r(this,t,"f")[0]=8191&a[0],r(this,t,"f")[1]=8191&(a[0]>>>13|a[1]<<3),r(this,t,"f")[2]=7939&(a[1]>>>10|a[2]<<6),r(this,t,"f")[3]=8191&(a[2]>>>7|a[3]<<9),r(this,t,"f")[4]=255&(a[3]>>>4|a[4]<<12),r(this,t,"f")[5]=a[4]>>>1&8190,r(this,t,"f")[6]=8191&(a[4]>>>14|a[5]<<2),r(this,t,"f")[7]=8065&(a[5]>>>11|a[6]<<5),r(this,t,"f")[8]=8191&(a[6]>>>8|a[7]<<8),r(this,t,"f")[9]=a[7]>>>5&127;const l=o.slice(16,32);n.i16(l,0,8),f(this,s,new Uint16Array(l.buffer),"f")}hash(s=!1){const f=s?0:2048;n.i16(r(this,h,"f"),0,10),r(this,i,"f")[0]+=8191&r(this,e,"f")[0],r(this,i,"f")[1]+=8191&(r(this,e,"f")[0]>>>13|r(this,e,"f")[1]<<3),r(this,i,"f")[2]+=8191&(r(this,e,"f")[1]>>>10|r(this,e,"f")[2]<<6),r(this,i,"f")[3]+=8191&(r(this,e,"f")[2]>>>7|r(this,e,"f")[3]<<9),r(this,i,"f")[4]+=8191&(r(this,e,"f")[3]>>>4|r(this,e,"f")[4]<<12),r(this,i,"f")[5]+=r(this,e,"f")[4]>>>1&8191,r(this,i,"f")[6]+=8191&(r(this,e,"f")[4]>>>14|r(this,e,"f")[5]<<2),r(this,i,"f")[7]+=8191&(r(this,e,"f")[5]>>>11|r(this,e,"f")[6]<<5),r(this,i,"f")[8]+=8191&(r(this,e,"f")[6]>>>8|r(this,e,"f")[7]<<8),r(this,i,"f")[9]+=r(this,e,"f")[7]>>>5|f;let o=0;const a=new Uint32Array(10);let c=0,l=0;for(;c<5;c++){for(a[c]=o,l=0;l<=c;l++)a[c]+=r(this,i,"f")[l]*r(this,t,"f")[c-l];for(;l<5;l++)a[c]+=5*r(this,i,"f")[l]*r(this,t,"f")[c+10-l];o=a[c]>>>13,a[c]&=8191,a[c]+=5*r(this,i,"f")[5]*r(this,t,"f")[c+5],a[c]+=5*r(this,i,"f")[6]*r(this,t,"f")[c+4],a[c]+=5*r(this,i,"f")[7]*r(this,t,"f")[c+3],a[c]+=5*r(this,i,"f")[8]*r(this,t,"f")[c+2],a[c]+=5*r(this,i,"f")[9]*r(this,t,"f")[c+1],o+=a[c]>>>13,a[c]&=8191}for(;c<10;c++){for(a[c]=o,a[c]+=r(this,i,"f")[0]*r(this,t,"f")[c-0],a[c]+=r(this,i,"f")[1]*r(this,t,"f")[c-1],a[c]+=r(this,i,"f")[2]*r(this,t,"f")[c-2],a[c]+=r(this,i,"f")[3]*r(this,t,"f")[c-3],a[c]+=r(this,i,"f")[4]*r(this,t,"f")[c-4],o=a[c]>>>13,a[c]&=8191,l=5;l<=c;l++)a[c]+=r(this,i,"f")[l]*r(this,t,"f")[c-l];for(;l<10;l++)a[c]+=5*r(this,i,"f")[l]*r(this,t,"f")[c+10-l];o+=a[c]>>>13,a[c]&=8191}o=5*o+a[0],a[0]=8191&o,o>>>=13,a[1]+=o,r(this,i,"f").set(a),this._bPos=0}write(t){let s=t.length,i=0,e=this.blockSize-this._bPos;for(;s>0;){if(e>s)return r(this,h,"f").set(t.subarray(i),this._bPos),void(this._bPos+=s);r(this,h,"f").set(t.subarray(i,i+this.blockSize),this._bPos),this._bPos+=e,this.hash(),i+=e,s-=e,e=this.blockSize}}sum(){return this.clone().sumIn()}sumIn(){this._bPos>0&&(r(this,h,"f")[this._bPos++]=1,r(this,h,"f").fill(0,this._bPos),this.hash(!0));let t=0;for(let s=1;s<10;s++)r(this,i,"f")[s]+=t,t=r(this,i,"f")[s]>>>13,r(this,i,"f")[s]&=8191;r(this,i,"f")[0]+=5*t,t=r(this,i,"f")[0]>>>13,r(this,i,"f")[0]&=8191,r(this,i,"f")[1]+=t,t=r(this,i,"f")[1]>>>13,r(this,i,"f")[1]&=8191,r(this,i,"f")[2]+=t;const e=new Uint16Array(10);t=5;for(let s=0;s<10;s++)e[s]=r(this,i,"f")[s]+t,t=e[s]>>>13,e[s]&=8191;const f=(1^t)-1,o=~f;for(let t=0;t<10;t++)r(this,i,"f")[t]=r(this,i,"f")[t]&o|e[t]&f;r(this,i,"f")[0]=r(this,i,"f")[0]|r(this,i,"f")[1]<<13,r(this,i,"f")[1]=r(this,i,"f")[1]>>3|r(this,i,"f")[2]<<10,r(this,i,"f")[2]=r(this,i,"f")[2]>>6|r(this,i,"f")[3]<<7,r(this,i,"f")[3]=r(this,i,"f")[3]>>9|r(this,i,"f")[4]<<4,r(this,i,"f")[4]=r(this,i,"f")[4]>>12|r(this,i,"f")[5]<<1|r(this,i,"f")[6]<<14,r(this,i,"f")[5]=r(this,i,"f")[6]>>2|r(this,i,"f")[7]<<11,r(this,i,"f")[6]=r(this,i,"f")[7]>>5|r(this,i,"f")[8]<<8,r(this,i,"f")[7]=r(this,i,"f")[8]>>8|r(this,i,"f")[9]<<5;const a=new Uint8Array(u),c=new Uint16Array(a.buffer);let l=0;for(let t=0;t<8;t++)l=r(this,i,"f")[t]+r(this,s,"f")[t]+l,r(this,i,"f")[t]=l,l>>>=16;return c.set(r(this,i,"f").subarray(0,8)),n.i16(a,0,8),a}reset(){this._bPos=0,r(this,h,"f").fill(0),r(this,i,"f").fill(0)}newEmpty(){const i=new Poly1305(new Uint8Array(32));return r(i,t,"f").set(r(this,t,"f")),r(i,s,"f").set(r(this,s,"f")),i}clone(){const e=new Poly1305(new Uint8Array(32));return r(e,t,"f").set(r(this,t,"f")),r(e,s,"f").set(r(this,s,"f")),r(e,h,"f").set(r(this,h,"f")),e._bPos=this._bPos,r(e,i,"f").set(r(this,i,"f")),e}static fromCrypt(t){if(t.blockSize<32)throw new y(32,"c.blockSize",t.blockSize);const s=new Uint8Array(t.blockSize);return t.encryptInto(s,s),new Poly1305(s.subarray(0,32))}}t=new WeakMap,s=new WeakMap,i=new WeakMap,h=new WeakMap,e=new WeakMap;class b{constructor(t,s,i){this.tagSize=u,this._stage=0,this._adLen=a.fromI32s(0,0),this._cLen=a.fromI32s(0,0),this._crypt=new i(t,s),this._hash=Poly1305.fromCrypt(this._crypt)}get blockSize(){return this._crypt.blockSize}writeAD(t){if(this._stage>1)throw new Error("Associated data can no longer be written");this._stage=1,this._adLen.addEq(o.fromInt(t.length)),this._hash.write(t)}finalizeAD(){if(1===this._stage){const t=16-(15&this._adLen.low);t<16&&this._hash.write(new Uint8Array(t))}this._stage=2}encryptInto(t,s){if(this._stage<2)this.finalizeAD();else if(3==this._stage)throw new Error("Cannot encrypt data after finalization");this._stage=2,this._crypt.encryptInto(t,s),this._hash.write(t),this._cLen.addEq(o.fromInt(s.length))}decryptInto(t,s){if(this._stage<2)this.finalizeAD();else if(3==this._stage)throw new Error("Cannot decrypt data after finalization");this._stage=2,this._crypt.decryptInto(t,s),this._hash.write(s),this._cLen.addEq(o.fromInt(t.length))}verify(t){if(this._stage<2&&this.finalizeAD(),2===this._stage){const t=16-(15&this._cLen.low);t<16&&this._hash.write(new Uint8Array(t)),this._hash.write(this._adLen.toBytesLE()),this._hash.write(this._cLen.toBytesLE())}this._stage=3,p("tag",t).exactly(u).throwNot();const s=this._hash.sumIn();let i=0;for(let h=0;h<s.length;h++)i|=t[h]^s[h];return 0===i}finalize(){if(this._stage<2&&this.finalizeAD(),2===this._stage){const t=16-(15&this._cLen.low);t<16&&this._hash.write(new Uint8Array(t)),this._hash.write(this._adLen.toBytesLE()),this._hash.write(this._cLen.toBytesLE())}return this._stage=3,this._hash.sumIn()}encryptSize(t){return t}}export class ChaCha20_Poly1305 extends b{constructor(t,s){super(t,s,c)}}export class Salsa20_Poly1305 extends b{constructor(t,s){super(t,s,w)}}export class XChaCha20_Poly1305 extends b{constructor(t,s){super(t,s,l)}}export class XSalsa20_Poly1305 extends b{constructor(t,s){super(t,s,_)}}